Lucene search

MitreCVE-2020-13133

HistoryJan 20, 2021 - 2:15 a.m.

CVE-2020-13133

2021-01-2002:15:12

CWE-79

mitre

web.nvd.nist.gov

tufin

securechange

cve-2020-13133

stored xss

r19.3 hf3

r20-1 hf1

vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) unauthenticated users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1

Affected configurations

Nvd

Node

tufinsecurechangeRange<r19-3

tufinsecurechangeMatchr19-3-

tufinsecurechangeMatchr20-1-

VendorProductVersionCPE
tufinsecurechange*cpe:2.3:a:tufin:securechange:*:*:*:*:*:*:*:*
tufinsecurechanger19-3cpe:2.3:a:tufin:securechange:r19-3:-:*:*:*:*:*:*
tufinsecurechanger20-1cpe:2.3:a:tufin:securechange:r20-1:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
tufin	securechange	*	cpe:2.3:a:tufin:securechange::::::::
tufin	securechange	r19-3	cpe:2.3:a:tufin:securechange:r19-3:-::::::
tufin	securechange	r20-1	cpe:2.3:a:tufin:securechange:r20-1:-::::::

References

github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md

portal.tufin.com/aspx/SecurityAdvisories

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

38.6%

JSON

Related for CVE-2020-13133